CRESCENTHARVEST

CRESCENTHARVEST is the codename used by Acronis Threat Research Unit (TRU) for a malware campaign potentially targeting supporters of Iran’s ongoing protests for information theft and long-term espionage. Acronis did not attribute the activity to a specific nation-state or APT group, but reported that the victimology, tradecraft, and scripting showed similarities to Iranian-aligned activity previously described by Check Point Research. The content also separately lists CRESCENTHARVEST among pre-existing cyber actors active before February 28 in campaigns involving phishing, exploitation of public servers, and information theft targeting Israeli, US, and regional networks, but does not provide high-confidence attribution beyond that mention. The campaign used protest-themed Farsi lures, including decoy images/videos and a Farsi-language report referencing the “rebellious cities of Iran.” Delivery was believed to occur via .RAR archives or files sent over time, containing malicious Windows .LNK shortcut files disguised as media. When executed, the .LNK files launched nested headless conhost.exe processes, then cmd.exe and PowerShell, extracted an embedded ZIP payload to %TEMP%, established persistence via a scheduled task triggered by Windows NetworkProfile connectivity events, and displayed benign decoy media. Payload execution relied on DLL sideloading using a legitimate Google-signed software_reporter_tool.exe binary to load malicious DLLs. One DLL, urtcbased140d_d.dll, extracted and decrypted Chrome app-bound encryption keys and passed them locally via a named pipe. The other, version.dll, functioned as a RAT and information stealer. Reported capabilities included command execution, browser credential/cookie/history theft from Firefox, Chrome, and Edge, Telegram Desktop session theft, keylogging, local user enumeration, antivirus profiling via WMI, and JSON-over-HTTPS command-and-control. The malware also used dynamic API resolution and anti-analysis behavior involving Windows Job Objects. Observed C2 infrastructure included servicelog-information[.]com and 185.242.105.230, with Acronis noting intermittent Cloudflare proxying. Acronis reported the campaign was active no earlier than January 9 based on the earliest decoy image date. The content notes similarities to activity tracked by Check Point as Educated Manticore, which overlaps with APT42, Charming Kitten, and Mint Sandstorm, but this is presented as similarity rather than confirmed attribution.